Pharmaceutical Projects: Walking along the Risk Management Line

We manage risk so commonly (and unconsciously) in our everyday life that we tend to undervalue it. Risk management was officially introduced in the pharmaceutical world by the ICH guideline Q9 in 2005. Since then, it has been intensively used and, not infrequently, misused. Practice shows that risk assessment tools are often seen as an end in themselves, while such important things as brainstorming on the matter and getting to know the problem are underestimated. A pharmaceutical project provides a very good example of this: risk management is critical, but as there are many unknown factors, it has to be performed in a way that what really counts is understanding the problems we face. A pharmaceutical project has at least two actors, a pharmaceutical firm and an engineering company, possessing different backgrounds, and this often leads to different approaches. This may explain why risk management is not used as much as it should in pharmaceutical projects. Thus, this chapter considers a pharmaceutical project from the point of view of risk management.


Introduction
Quality is not a matter of discussion. Quality is necessary for any manufactured product. Failures mean losses in terms of money, logistics, and prestige, and no industry can withstand these damages. Pharmaceutical products share this situation, but, besides, their lack of quality turns out to be a public health problem. This is why the authorities require that medicines meet their specifications and manufacturers have the responsibility of exclusively commercializing products possessing their purported quality.
The production of medicines is in fact composed of two different types of manufacture. Firstly, there are facilities that produce the ingredients, or active pharmaceutical ingredients (APIs), used in the preparation of the medicines. Secondly, we have those facilities, which combine the ingredients to obtain pharmaceutical forms. These latter are packed to get what we know as a drug, medicine, or pharmaceutical. This chapter focuses on this second type of manufacture, although we consider biotechnology too (in spite of producing substances, which are used as ingredients).

About the pharmaceutical project
A pharmaceutical project can be defined as a temporary effort undertaken with the aim of creating facilities that allow manufacturing medicines with the required quality and assurance. This effort is usually a quite difficult one, because it has to be carried out by different partners, which should work together, even if pertaining to different technical areas.
The partners who take part in a project belong normally to two groupings. On one side, the "client" (that is, the pharmaceutical laboratory or, maybe, laboratories) desires to possess new manufacturing premises or modify old existing ones. On the other side, the "supplier" usually consists of an engineering company that in fact coordinates different suppliers, extending from the providers of construction materials and associated services to the sellers of pharmaceutical equipment. These two parts, which to simplify matters we are going to name from now on as "laboratory" and "engineering," are usually sharply asymmetric. The laboratory in these matters, generally speaking, has a much more limited experience than the engineering, whereas the knowledge regarding pharmaceutical norms is often less developed in the engineering. The amount and importance of these differences can vary a lot, but here we have a possible source of problems that should not be overlooked and that makes very advisable tight control on a project. 3 Pharmaceutical Projects: Walking along the Risk Management Line DOI: http://dx.doi.org/10.5772/intechopen.82601

Structure of a pharmaceutical quality system (PQS)
The paradigm of quality described by the ICH guidelines, Q8 to Q12 [1,[2][3][4][5], should also be applied to pharmaceutical projects, but taking into account the existing differences between manufacturing and managing a project. This is why not all the elements of a quality system devised for products can be applied into a pharmaceutical project. Let us analyze this (Figure 1).
The development and implementation of a PQS is the result of the definition of a quality policy by a laboratory. In order to put this policy into practice, the company writes a quality manual and associated documents that develop it in more detail. A quality manual should address the following topics: 1. The PQS is devised to ensure the application of GMP by the laboratory. As shown in Figure 1, the PQS covers the whole life cycle of a medicine, excluding the stage of development (this is the consequence of an old tradition of working in development centers and of the difficulty of applying the strict controls of GMP to a development laboratory).
2. Management responsibilities should be clearly stated. Practice shows that this is very important. As in old battles, the army can only win the war if there is a (good) chief leading it.
3. ICH Q10 describes two capacitors, intended to help in the task of reaching the objectives. The first one is risk management and we will discuss it in detail further on, as the main topic of this chapter. The second one is knowledge management and its intent is fighting the very pernicious practice that rules in more than one company: that is, people who get some knowledge on products Perspectives on Risk, Assessment and Management Paradigms or processes do not inform the others, but keep it for them and, consequently, there is a continual loss of information.
4. The PQS contains four elements (Figure 1). All of them, albeit not in this form, are very important in a project.

Project life cycle
A life cycle approach is an important element for ensuring the global quality of a process. As mentioned before, quality has to be designed in order to be controlled. The term "designed quality," applied to a pharmaceutical project, means that objectives are well defined and that critical variables have been identified and quantified. This allows for a monitoring and evaluation of the project: if the critical variables are kept under control, then objectives will be met. Thus, the life cycle has to be considered as a chain of events that progressively increase the amount of information and build quality gradually.
As it can be seen (Figure 2), the life cycle of a project is composed of four phases, although only the first two (design and realization) concern what we have been calling pharmaceutical project and are managed by the two partners. The latter two phases (manufacture and discontinuation) are just the consequence of the former two and they belong exclusively to the laboratory. In fact, instead of  "manufacture," we can talk of "routine production," where quality is the result of the quality of the project plus all the measures applied to build quality into the products and to monitor that this is correctly realized. The last phase, discontinuation, is simply mentioned to remind us that when facilities have to stop production to be closed, this has to be done in an organized way (i.e., market cannot be left undersupplied by a unilateral decision; the environment has to be protected by recycling or disposing of materials in an ecological way, etc.). Figure 3 summarizes the basic definitions related with risk management, as described in guideline ICH Q9 [3]. In any activity, there are hazards, which are significant because they can turn into harms. It is evident that hazards matter because there is a chance that they materialize into harms, and it is obvious that the importance of the harm determines how much attention they deserve. Thus, it is easy to understand the definition of the risk.

Risk management
There is no human activity free from hazards (and, unfortunately, from harms) and, consequently, risk is always extant. This is why we came to speak of risk management. As we always face risk, it is meaningful to understand it and try to diminish it. When we remove a dish from an (hot) oven, there is a hazard: we can burn our fingers. To diminish the risk, we use an oven glove. By donning a glove, we diminish the probability of the harm and, thus, the risk. And what about the severity of the harm? In general, it is considered that we cannot act against it, as the severity of a harm is an attribute of it. Anyway, we might also think that the simple fact of wearing a glove would diminish the severity of the burn. Yes, in the interpretation of risk, there is always some amount of personal understanding, but this is not very relevant if we come to appreciate the situation well and we apply the same criteria over time. Just to finish with these considerations, we should keep in mind that the exact assessment of risk is second to the accurate understanding of the hazard. This is why in many cases we need not determine risk but just assess the hazards (Which hazards exist? Which are their causes? Are they likely? After all, should we worry? Should we take any measure? etc.). Figure 4 summarizes the different levels of risk or of hazard assessment (to express it in a different way). As we can see, the objective is always reducing the level of risk as much as possible. This reduction, however, should be consistent with the efforts, which we apply for attaining this effect. Sometimes, a high risk might be accepted if there is no better alternative. There are several tools, which we can use for risk analysis [3]. They can be used and combined according to particular needs. In fact, the application of a standard method is necessary when high levels of formality are required (e.g., in comparative studies or in scientific papers), but for the routine risk assessment within a company, it is possible to be less formal and adapt the tools to better fit our needs. Tools just organize information. They do not improve our information (if our raw data are poor or inaccurate, the application of the best of tools will not mend them). Thus, the quality of a risk analysis depends mainly on how worth our information is and on the knowledge and experience of the person who performs the study. Figure 5 lists the most common methodologies used in risk analysis. Among the specific ones, the most popular is, without any doubt, FMECA, an excellent tool when the process under study is well known. Then, it is possible to evaluate risk and use its value as an indicator for process improvement. Anyway, in most cases, when the amount of knowledge is more modest, it is better to start with PHA. HACCP is a very good tool for the control of processes; in fact, the WHO recommends it for   the control of pharmaceutical manufacturing processes [6]. It is not necessary to add that HACCP requires a deep knowledge on the process. FTA is useful to identify the root causes of a problem. HAZOP can help to identify possible problems related to equipment and operation involved in a process. RRF is the choice tool for the comparison of items composed of different elements.
Next to the specific methodologies, we can talk of unspecific ones. Properly speaking they are not risk analysis tools but provide information, which is critical to perform an analysis. Here, we should emphasize flowcharts, which are a key element to start a risk analysis of a process.
For the risk management of pharmaceutical projects, we select, besides flowcharts, RRF and PHA. This is why, we consider useful to provide some guidance on them.
Flowcharts are very useful to get a clear idea of a process and to perform a hazard assessment. In fact, the layout of a pharmaceutical unit is the translation of the flowchart steps into premises. The example of flowchart, which we present here in Figure 6, covers in a simplified way the operational stages of a pharmaceutical unit. It is evident that in practice there can be different types of processes.
RRF (Figure 7) is a tool conceived for the comparison of different items, possessing different types of hazards and risk levels, by reducing them to a common denominator. The application of RRF starts by identifying the items to be compared and identifying their components and subcomponents. Then, the risk factors are determined and their integration allows for the establishment of the global risk of the item. As shown in Figure 7, all Rf are given the same weight and, thus, the load of each component depends more on the number of Rf considered than on the importance of the component itself. This can be corrected, for example, by giving a higher classification of risk to single Rf or to all the Rf of a given component.  PHA is very practical for the analysis of situations where there is still limited information. PHA uses charts like the one shown in Table 1 (although, often, the column describing the effect can be omitted, because it does not provide any useful information).  Practice shows that, while performing risk analysis, one of the points that creates more confusion is the clear distinction among hazard, cause of the hazard, and effect of the hazard (harm). To simplify this matter, we propose the following approach.
We establish six types of hazards as the base of our analysis (Figure 8), then we apply them to the item that we study and we determine if this hazard might exist. If it really exists, then it is easier to establish possible causes and their derived effects and to propose control measures.

Pharmaceutical project management 7.1 Supplier selection
It is not necessary to insist on the fact that the selection of the partner with whom a laboratory will realize a project is very important. Following, we provide a simplified example of application of RRF.
Component (1)  Then, the global risk of each item is evaluated adding the risks of their components.
Finally, the items are ranked according to their respective risk. Thus, they can be compared. They can also be "filtered," that is, selected (Figure 6).

Translation of the URS into a plan
As shown in Figure 9, a pharmaceutical plan is the practical translation of the requirements set up in the URS.
The conditions penned in the URS depend on the particular wishes of each laboratory, whereas the plan to be developed and constructed by the engineering is encoded, by GMP [7-10] and good engineering practice (GEP). GEP is not codified as such. It is understood as the generally admitted good approach.
Let us analyze, using a risk management approach, the requirements that should meet a project. We use an adapted form of PHA.

Hazard #1: (external) contamination
In Table 2 are described the main causes of (external) contamination and the control measures to keep them at bay.

Hazard #2: cross-contamination
In Table 3 are described the main causes of cross-contamination and the control measures to hold them at bay.   Table 4 evaluates the main causes of error/mix-up and provides control measures. Although error/mix-up appears because of the inefficiency of personnel (and this means that their prevention is based on training), an improved design of the premises diminishes their probability. Adequate flows and sufficient working space should always be considered in a project.

Hazard #4: degradation
Materials and products are damaged when exposed to inadequate conditions. Table 5 summarizes control measures.

Hazard #5: equipment malfunction
During routine production, equipment is submitted to a maintenance plan to avoid malfunction. During the project, however, equipment has to be well sited and mounted, as summarized in Table 6.

Hazard #4: health, safety, and environment
The denomination health, safety, and environment (HSE) covers all the aspects that can affect the health and security of personnel and the environment. Table 7 describes actions to control them.  Repair and maintenance operations should not affect the quality of the products (e.g., performed from outside the clean rooms). Thus, there should be technical areas for equipment and a technical space over the working areas for ducting, lightning, etc.
The layout of the premises should allow the production to take place in areas connected in the logical sequence of the required levels of cleanliness (e.g., of classification) Materials and products should only be exposed to the environment in clean rooms possessing sanitary design  The storage areas should allow for the orderly and sure storage of the different sorts of materials and products ("traditional warehouse") or possess a computerized management system providing the same level of security ("chaotic warehouse") The layout of the premises should allow the production to take place in areas connected in the logical sequence of the operations The areas should permit the orderly and local positioning of equipment and materials In the production areas, there should be in-process storage rooms permitting to keep materials and equipment in an orderly way Packaging areas should be designed and laid out to avoid mix-ups The QC laboratory should have sufficient space

Inadequate separation
The storage areas should ensure the segregation for items under quarantine, returned, rejected, and recalled. This separation can be assured by separated and closed areas or by a computerized management system providing the same level of segregation

Management of toxic substances
Sometimes commercial/logistic aspects determine from the outset the characteristics of a pharmaceutical plant: typically, multiproduct facilities (when APIs are not particularly active and general GMP precautions suffice for ensuring that significant  cross-contamination will be excluded) or, less frequently, dedicated facilities, when logistic reasons recommend limiting the number of products in order to increase output. A quite different situation may arise when APIs can be deemed "toxic." This term is used in a practical way to provide a general denomination for substances that possess high activity or potency (e.g., tiny amounts are needed to produce a pharmacological effect) or harmful effects (e.g., sensitization, genotoxicity, etc.). When designing premises where toxic APIs will be handled, there has always existed a key question: is it correct if they are multiproduct or we should opt for dedicated ones? The response to this question cannot be general, because substances are diverse. The traditional approach was considering, roughly speaking, three cases. Firstly, we had the APIs, which could be deemed nontoxic and which, as we said before, could be produced in multiproduct facilities. Secondly, we had the APIs possessing high activity (e.g., hormones, cytostatics, certain antibiotics, etc.), which required dedicated facilities. And finally, we had two cases, which required strict segregation. This last group included live microorganisms and products possessing sensitizing or toxic effects (their action, properly speaking, cannot be quantified and should be considered as "on/off "), such as beta-lactam antibiotics [11].
In order to better clarify this group, it was proposed a scientific approach, which is summarized in Figure 10. The flowchart combines an EMA guideline on this matter [12] (upper part with a darker shade) with logistic criteria (lower part).
When it is spoken of single product or multiproduct facilities, their meaning appears evident, but what about dedicated facilities? This implies separation, but what kind of separation. Only risk management can provide an adequate answer to this question. Figure 11 describes the rationale of this approach. The rectangle represents the risk level (on the left lower part, the lighter color indicates low risk, whereas, on the right upper part, the darker color shows high risk). Thus, multiproduct facilities are adequate when risk is low, and segregated facilities are necessary when risk is high. Then, in the middle, where risk can be deemed medium, it is possible to think of intermediate solutions (e.g., instead of separation of facilities, separation of products) or campaign production (e.g., separation is not physical but temporal). The severity of the hazard depends on the API, whereas the probability of occurrence is related to the way of manufacturing. In other words, once the "toxicity" of the API is known, the practical level of risk will depend on the production techniques used for the manufacture of the products. Dedicated facilities mean more expensive projects, but at the same time lower risk of cross-contamination and, for instance, easier and surer cleaning validations [13].

Management of biological systems
Biotechnology implies the use of biological systems. Under this term, we design both cells and microorganisms. Most of them (in principle, the cells, and many microorganisms) do not pose any particular thread to personnel. In fact, the contrary is true. They are labile and very susceptible to contamination and require strict measures of control to keep them viable. There are, however, microorganisms, which suppose a thread for the personnel if they infect them during operations. These "biological agents" are internationally classified into four groups ( Table 8) in function of the level of biosecurity (BSL) or protection level (PL) that they require [14,15].
The project of a laboratory handling biological agents has to take into account its two types of requirements: on the one hand, those regarding in general a pharmaceutical laboratory and on the other, the particular necessities of facilities containing live microorganisms. We have already considered the former; thus, here we will exclusively discuss the latter.   In a laboratory where biological agents are cultured, these microorganisms suppose the "hazard"; the "cause" is the inadequacy of the measures taken to ensure that these agents will remain contained; and the "effect" is the infection of people by released agents. Thus, our risk analysis will focus on the control measures ( Table 9).  The international sign of biological hazard should be affixed at the entrance of the laboratory and at critical rooms and critical equipment (e.g., incubators, freezers, etc.). Table 9.
Control measures for biological hazard in the laboratory.
© 2018 The Author(s). Licensee IntechOpen. This chapter is distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/ by/3.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Author details
Jordi Botet GMP Consultant, Barcelona, Spain *Address all correspondence to: jbotetfregola@gmail.com In Table 9, we mention a series of elements that should be taken into account when designing a laboratory manipulating biological agents. The characteristics of these elements depend on the BSL/PL. This means that they might be unnecessary for level 1, just recommended for an intermediate level and required for a high level. It has to be studied case by case, using a risk management approach, which should analyze the level of risk and the level of protection provided for the systems in place.

Conclusions
Society requires medicines possessing the purported quality, and this is only possible if we design, manufacture, monitor, and control them adequately. These undertakings, however, involve appropriately devised, built, and qualified premises and facilities, which are the outcome of a project. A pharmaceutical project is a very complex subject because it involves at least two parts, with different visions and experience, and because it implies scores of suppositions and projections into the future. The risk of straying away from the expected roadmap is quite real. Thus, risk management becomes necessary. In a project, the amount of information is limited and thus, while using risk analysis tools, it is essential to bear in mind that what really matters is to understand which problems are at stake and to get a clear picture of their respective relevance. Once this is achieved, it is easier to provide adequate solutions. Risk is controllable, if we know and understand it! A frequent problem, when trying to evaluate risk, is that information is so varied and multiform that it becomes difficult to ascertain, which are the hazards and distinguish them from, say, causes and effects, let alone the logical organization of the information. To overcome these difficulties, we propose two tiers of solutions: on one side, to use simple risk analysis tools focusing more on hazard and control measures than on risk quantification and on the other, to use defined simple quality hazards as the point of departure for the analysis.

Conflict of interest
None.